Privacy Policy

Who we are

ThatWish ("we", "us") is an application operated from Québec, Canada. This policy explains what personal information we collect, why, and your rights under Québec’s Law 25 and applicable Canadian privacy law.

Information we collect

Account information you provide: your email address, display name, and date of birth.

Sign-in codes: we sign you in by emailing you a one-time code. We store it only in hashed form, until it is used or expires a few minutes later.

Bot check: when you request a sign-in code, Cloudflare Turnstile checks that the request comes from a person, using technical signals such as your IP address and browser characteristics. It is not used for advertising.

Content you create: wishlist items and links, gift reservations, group memberships, and - if your group enables it - Secret Santa assignments and the pairs who shouldn’t draw each other.

Product photos: when you add a shop link, ThatWish reads that page’s public title and photo. The photo is then shown straight from the shop’s website, which, like any image, can see the viewer’s IP address.

Limited technical data: privacy-friendly, aggregate, cookieless usage analytics. We do not use advertising or cross-site tracking.

How we use your information

To provide the service: create your account, host your wishlists, let members reserve gifts, and show upcoming birthdays.

To keep the service secure and prevent abuse.

To understand and improve how the app is used.

Cookies and similar technologies

Essential cookie: a secure session cookie keeps you signed in. It is required for the app to work and cannot be turned off.

Preferences: a cookie remembers the language you choose.

Analytics: a privacy-friendly, cookieless analytics tool that measures aggregate usage. It sets no tracking cookies and does not identify you.

Who we share it with

We do not sell your personal information.

We use trusted service providers that process data on our behalf: Neon (database hosting), Vercel (application hosting and analytics), Resend (sending account emails such as sign-in codes, and the notice that a Secret Santa draw is ready), and Cloudflare (the bot check on the sign-in page). They may store data outside Québec.

We may disclose information if required by law.

How long we keep it

We keep your information while your account is active. You can delete your wishlists, leave groups, or delete your account at any time, after which we remove your personal data within a reasonable period.

Your rights

Under Québec’s Law 25, you may access, correct, or delete your personal information, withdraw your consent, and request a copy of your data (portability).

To exercise these rights, contact us at thatwishapp@gmail.com.

You also have the right to file a complaint with the Commission d’accès à l’information du Québec (CAI).

Person responsible for personal information

The person responsible for the protection of personal information at ThatWish can be reached at thatwishapp@gmail.com.

Children

ThatWish is not directed to children under 14. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. The "last updated" date above reflects the latest version.

Contact

Questions? Email us at thatwishapp@gmail.com.